CVE-2026-81533: MongoDB BI Connector ODBC Buffer Overflow

CVE-2026-81533 Overview

CVE-2026-81533 is a stack-based buffer overflow [CWE-121] in the MongoDB BI Connector ODBC Driver. The driver copies the digit sequence following a SQL LIMIT clause into a fixed-size internal buffer without bounds checking. An authenticated user who can influence the numeric portion of a LIMIT clause can crash the hosting application process or corrupt adjacent process memory. The flaw only triggers on connections where the driver's optional prefetch setting is enabled.

Critical Impact
Attackers with the ability to submit SQL statements can terminate the hosting application process or corrupt adjacent memory, causing denial of service and potential memory tampering in the driver's process context.

Affected Products

MongoDB BI Connector ODBC Driver (connections with prefetch enabled)
Applications embedding the MongoDB BI Connector ODBC Driver
Analytics and reporting tools that route SQL to MongoDB via the BI Connector

Discovery Timeline

2026-08-28 - CVE-2026-81533 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-81533

Vulnerability Analysis

The MongoDB BI Connector ODBC Driver parses SQL statements before forwarding them to the MongoDB backend. When the driver encounters a LIMIT clause, it extracts the trailing digit sequence and copies those characters into a fixed-size stack buffer. The copy routine does not validate the length of the digit run against the destination buffer size. A SQL statement containing an unusually long numeric literal after LIMIT overruns the buffer and corrupts adjacent stack memory in the calling process.

The vulnerability requires that the connection have the driver's optional prefetch setting enabled. Without prefetch, the affected code path is not exercised. This constraint is reflected in the CVSS 4.0 vector through the AT:P attack requirement.

Root Cause

The root cause is missing bounds validation during string handling of the LIMIT numeric operand [CWE-121]. The driver assumes numeric literals will fall within a practical size range and uses a fixed-size stack buffer without enforcing that assumption. Any digit sequence exceeding the buffer capacity overwrites adjacent stack data, including saved return addresses and local variables.

Attack Vector

The attacker must be able to submit or influence SQL statements processed by the driver, requiring low privileges on the hosting application. Attack surface includes any application layer that concatenates user-supplied values into LIMIT clauses without validating length. Impact is confined to the driver's process: the hosting application terminates or exhibits memory corruption, resulting in denial of service and possible integrity loss.

No public proof-of-concept exploit is available for this vulnerability. See the GitHub MongoDB ODBC Driver Releases page for technical release details.

Detection Methods for CVE-2026-81533

Indicators of Compromise

Unexpected termination or crash of applications that load the MongoDB BI Connector ODBC Driver
Application or Windows Error Reporting crash dumps referencing the ODBC driver module in the faulting stack frame
SQL query logs containing LIMIT clauses followed by abnormally long digit sequences
ODBC trace files showing prefetch-enabled sessions immediately before a process crash

Detection Strategies

Inspect query logs and application audit trails for LIMIT clauses containing digit runs longer than typical numeric ranges (for example, more than 20 digits).
Correlate application crash events with recent SQL activity issued through the BI Connector ODBC Driver.
Enable ODBC driver tracing on a controlled subset of hosts to capture the SQL text that precedes any driver-related fault.

Monitoring Recommendations

Alert on process termination for reporting, analytics, and ETL applications that link the BI Connector ODBC Driver.
Monitor ODBC connection strings and DSN configurations for the prefetch option to prioritize patching on exposed hosts.
Track SQL statements from low-privilege application users that write user input directly into LIMIT operands.

How to Mitigate CVE-2026-81533

Immediate Actions Required

Inventory hosts and applications using the MongoDB BI Connector ODBC Driver and identify connections with prefetch enabled.
Upgrade the driver to the latest fixed release published on the vendor's GitHub releases page.
Validate and constrain the length of any user-supplied value that reaches a SQL LIMIT clause.

Patch Information

MongoDB publishes fixed releases through the GitHub MongoDB ODBC Driver Releases page. Apply the most recent release that addresses CVE-2026-81533 across all systems using the BI Connector ODBC Driver.

Workarounds

Disable the driver's optional prefetch setting on affected DSNs and connection strings until the patched driver is deployed.
Enforce server-side or application-side validation that rejects LIMIT values exceeding a small maximum length.
Restrict SQL submission to trusted application accounts and remove direct SQL entry paths for untrusted users.

bash

# Configuration example: disable prefetch in an ODBC DSN entry (Linux odbc.ini)
[MongoDB_BI]
Driver = MongoDB ODBC ANSI Driver
SERVER = mongo-bi.example.local
PORT   = 3307
DATABASE = analytics
# Workaround until patched: ensure prefetch is not enabled
PREFETCH = 0